Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-LOG-04: Audit Logs Access and Accountability

What else in your programme already covers this

This control maps to 26 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

C5 (Germany) · 3 controls

C5-DEV-07 Logging of changes
C5-OPS-12 Logging and Monitoring - Access, Storage and Deletion
C5-OPS-16 Logging and Monitoring - Configuration

Australia My Health Records Act 2012 · 2 controls

MYHR-SEC-2 Access controls and user account management
MYHR-SEC-3 Audit logging and access monitoring

Azure Security Benchmark · 2 controls

ASBv3-LT-2 Enable threat detection for identity and access management
ASBv3-PA-7 Follow just enough administration (least privilege) principle

CMMC 2.0 · 2 controls

AU.L2-3.3.2 User Accountability
AU.L2-3.3.9 Audit Management

NIST SP 800-53 Rev 5 · 2 controls

NIST800-AU-10 AU-10 Non-repudiation
NIST800-AU-9 AU-9 Protection of Audit Information

PCI DSS 4.0 · 2 controls

10.2.1.3 10.2.1.3 Access to the audit logs is itself logged
10.3.1 10.3.1 Audit log read access limited to job need

ACSC Essential Eight · 1 control

E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)

AWS Well-Architected Security Pillar · 1 control

SEC04-BP01 Configure service and application logging

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1 · 1 control

LOG-04 Audit Logs Access and Accountability

FedRAMP High · 1 control

AU-9(4) Access by Subset of Privileged Users

FedRAMP Moderate · 1 control

AU-9(4) Access by Subset of Privileged Users

HIPAA Security Rule · 1 control

164.312(a)(2)(i) Unique User Identification (Required)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-171 Rev 3 · 1 control

03.03.08 Protection of Audit Information

NIST SP 800-218 · 1 control

SP800-218-PS.1.1 Protect All Forms of Code from Unauthorized Modification

NIST SP 800-66 Rev 2 · 1 control

164.312(a)(2)(i) Unique User Identification (Required)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-LOG-04 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free